In 2025, the U.S. Environmental Protection Agency (EPA) reported it had made strides in securing water systems against cyberattacks. The agency’s Office of Water (OW) identified vulnerabilities in 277 water systems and implemented customised solutions to address these issues. These included updates to authentication protocols, stricter access controls, and other technical measures aimed at protecting critical components of water management infrastructure.
Jess Kramer, the EPA’s Assistant Administrator for Water, said: “Access to clean and safe water is essential to public health, agriculture, and economic growth. The threat of cyberattacks is an increasing concern, and it’s vital that water systems take proactive steps to address this risk.”
“EPA is dedicated to assisting these systems with cybersecurity, addressing 350 vulnerabilities in 2025 alone. Many of the solutions we recommend are low-cost or free, making them accessible to systems of all sizes,” Kramer added.
The EPA’s work goes beyond addressing vulnerabilities; the agency is partnering with the Cybersecurity and Infrastructure Security Agency (CISA), state governments, and water industry associations to reduce the risk of cyberattacks. The agency has urged water systems to adopt basic cybersecurity practices, such as limiting the exposure of operational technology to the public internet, maintaining up-to-date asset inventories, and implementing strong authentication measures.
As part of its ongoing efforts, the EPA is providing free cybersecurity assessments and technical assistance to water systems. In August, the agency announced over $9 million in grant funding to support mid-sized and large water systems in strengthening their cybersecurity and resilience against extreme weather events.
